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IN THE UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF VIRGINIA 



Alexandria Division 



KIM DOTCOM, et al, 



UNITED STATES OF AMERICA 



Defendants 



v. 



) 
) 
) 
) 
) 
) 
) 
) 



The Honorable Liam O'Grady 



CriminalNo. l:12-CR-3 



[PROPOSED] REDACTED SUPPLEMENT AL BRIEF OF SPECIALLY APPEARING 
DEFENDANT AND INTERESTED PARTY MEGAUPLOAD LIMITED 



On October 22, 2012, interested third-party Kyle Goodwin moved to unseal certain 
search warrant materials related to this case, on the grounds that such materials "will not only be 
relevant to any Rule 41(g) inquiry, but will likely include evidence Mr. Goodwin will present as 
part of his ongoing efforts to have his property returned." (See Dkt. 131.) In its response to Mr. 
Goodwin' s motion, the Government proposed that the Court unseal the materials, with only 
minimal redactions. (See Dkt. 139.) The Court adopted the Government' s proposal and 
unsealed the materials on November 7, 2012. (See Dkt. 145.) This recent unsealing lays bare a 
crucial omission the Government made in applying for the search warrants it used to seize 
domain names belonging to Defendant Megaupload Limited ("Megaupload"). Specifically, the 
Government' s affidavits underpinning the warrants omitted critical, exculpatory information 
regarding whether, why and how Megaupload knew it was hosting criminally infringing files. 
The Government represented that, "[o]n or about June 24, 2010, members of the Mega 
Conspiracy were informed, pursuant to a criminal search warrant from the U.S. District Court for 
the Eastern District of Virginia, that thirty-nine infringing copies of copyrighted motion pictures 
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were present on their leased servers at Carpathia Hosting, a hosting company headquartered in 
the Eastern District of Virginia," and that, "[a]s of November 18, 2011, thirty-six of the thirty- 
nine infringing copies of copyrighted motion pictures were still being stored on servers 
controlled by the Mega Conspiracy," after it was informed of the infringing content. 1 (See Dkt. 
145-1 at 11, 38, 61, 84, 105-106) This snippet — which appears in each relevant affidavit and is 
the only direct, corroborated evidence the Government purports to offer as proof that 
Megaupload had requisite knowledge — suggests that Megaupload was warned of its potentially 
criminal complicity yet persisted in hosting the files without concern for their illegal content. 
The affidavits, in short, paint Megaupload as a brazen scofflaw. 

The truth, as the Government well knows, is quite different. Megaupload had every 
reason to retain those files in good faith because the Government had sought and obtained 
Megaupload 's cooperation in retrieving the files and warned that alerting users to the existence 
of the warrant and the Government 's interest in the files could compromise the investigation. 
Thus, the Government selectively parsed its account so as to exclude critical facts that negate any 
notion that Megaupload had criminal mens rea to retain the infringing files. The Government 
deliberately neglected to apprise the Court that: 

• Megaupload received the June 24, 2010 warrant in the course of cooperating 
with a Government investigation; 

• Megaupload was informed of the June 24, 2010 warrant by its vendor, 
Carpathia Hosting ("Carpathia"), with the Government' s consent and for the 
express purpose of obtaining Megaupload' s voluntary assistance with 
executing the warrant; 

• the Government declined to communicate directly with Megaupload about the 
warrant, instead deputizing Carpathia to communicate on its behalf; 

• Carpathia informed Megaupload that the warrant was sealed, and that only 
Carpathia and Megaupload, not the users of the infringing files, were to know 

1 This same representation appears in the Superseding Indictment. (Dkt. 34 at 26.) 
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of its existence, and at the Government' s request provided Megaupload a copy 
of the sealing order. The sealing order provides, in relevant part: 




• Carpathia directed Megaupload not to open "EM7 tickets" on the infringing 
files — which would have alerted a larger number of people to the existence of 
the warrant and jeopardized the secrecy of the investigation — "[b]ecause of 
the Government' s seal on the warrant," asking that Megaupload instead deal 
directly with a single person at Carpathia; 

• Megaupload's preservation of the status quo, particularly by not taking down 
or otherwise disturbing the files identified in the June 24, 2010 warrant, was 
faithful to the Government' s express desire, reflected by the Magistrate 
Judge's order sealing the warrant (provided to Megaupload by Carpathia at 
the Government' s request) and by Carpathia' s instructions on the 
Government' s behalf, for Megaupload to ensure that evidence would remain 
preserved and that the target users would remain unaware of the investigation; 
and 

• consistent with its stated desire that the warrant and investigation remain 
confidential so as not to tip off the target users, the Government — neither 
directly nor through Carpathia — ever requested that Megaupload take down 
the files identified in the June 24, 2010 warrant. 

Although it is now apparent that Megaupload, itself, was the target of a criminal 

investigation at the time it received the June 24, 2010 warrant from Carpathia, Megaupload was 
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led to believe otherwise at the time. Indeed, it was steered to cooperate with the Government by 
Carpathia's express assurance that the Government had given it "no reason to believe the [sic] 
MegaUpload is the target of the investigation." (See June 25, 2010 email from Phil Hedlund to 
Mathias Ortmann and Kim Dotcom, attached as Exhibit 1 .) By all indications, the Government 
tapped Carpathia to convey the June 24, 2010 warrant to Megaupload, thereby planting what the 
Government would later claim, for purposes of this case, amounted to criminal knowledge that 
Megaupload was hosting infringing files, while simultaneously lulling Megaupload into thinking 
it was not a target of its ongoing investigation (which the Government dubbed its "Mega 
Conspiracy" investigation) — and, what is worse, affirmatively leading Megaupload to understand 
from the warrant' s sealing order and Carpathia's representations that Megaupload should take no 
action with respect to the infringing files lest it tip off the ostensible targets. In sum, the 
Government came to paint as criminal the very course of conduct by Megaupload that the 
Government had induced in requesting good-faith cooperation with an investigation that was to 
remain secret. Most incredibly of all, however, the Government then came before this Court, ex 
parte, with a selective, distorted account whereby the Government omitted mention of facts — 
well known to the Government — indicating that Megaupload was of an innocent state of mind in 
cooperating with what it was told was an ongoing, secret investigation of the infringing files at 
issue. The Government deliberately misled the Court that signed the search warrants and failed 
to disclose material exculpatory information in violation of Brady v. Maryland, 373 U.S. 83 
(1963). 

Interested Party Kyle Goodwin in his motion to unseal the warrant materials noted that, 
"[a]s part of any hearing under Rule 41(g), Mr. Goodwin will need to investigate the 
government's actions surrounding the searches and seizures that occurred here." (Dkt. 131 at 7.) 
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The Court granted that motion in relevant part. Megaupload now respectfully submits that the 
issues outlined above, which go directly to the scope and propriety of the Government' s search 
and seizure of the Carpathia servers, would be relevant and properly heard at the Rule 41(g) 
hearing to be scheduled. Megaupload respectfully requests an opportunity to participate in any 
Rule 41(g) hearing, and asks that all interested parties be permitted to explore the warrants and 
their validity — issues that bear directly on Mr. Goodwin's ongoing efforts to have his property 
returned. 

FACTUAL BACKGROUND 
The June 24, 2010 Warrant: On or about June 24, 2010, the Government applied for a 
warrant to search jj^^^^^^^^^^^^^^^^ ^^^ ^^^ ^^fcAgaegi^ ^ ^^^^^^^ ^jg 

ü fl^H (June 24, 2010 Warrant, Attachment A, attached as Exhibit 2, at 5.) That 
application was approved by The Honorable Ivan D. Davis, U.S. Magistrate Judge, Eastern 
District of Virginia. (Id. at 4.) The warrant further authorized the Government to seize thirty- 
nine files identified in a Schedule attached to the warrant. 

The next day, on June 25, 2010, the Government sent the warrant and attachments to 
representatives of Carpathia Hosting who, at the Government' s request, then forwarded the 
warrant and attachments to Megaupload by email. (See June 25, 2010 email from Phil Hedlund 
to Mathias Ortmann and Kim Dotcom, Ex. 1.) Mr. Hedlund' s email explained that the warrant 
was a "sealed (meaning we cannot disclose to anybody) warrant with an exception to disclose to 
you." (Id.) His email further requested that, "[b]ecause of the Government's seal on the 
warrant," Megaupload coordinate any efforts to comply with the warrant with a specific 
Carpathia representative who was in the know, without publicly opening a ticket as it normally 
would. (Id.) Reinforcing that account, the sealing order accompanying the email found that 
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and authorized release solely by the Government to Carpathia and, through Carpathia, to 
Megaupload. (June 24, 2010 Order to Seal Signed by Magistrate Judge Davis, Ex. 2.) And Mr. 
Hedlund's email further reported "relay[ing] to the Government Mega's willingness to work with 
the Government for these types of requests— just as we discussed during the last day of our 
visit," and requested that Megaupload "please confirm as soon as possible that Mega will assist 
in collecting and providing this information," so that Carpathia could "communicate that to the 
Government." (Id.) 

Unbeknownst to Megaupload, however, it was already a target of a criminal 
investigation, presumably the very same investigation. (See e.g. Warrant l:12-sw-34, Dkt. 145-1 
at 6-7 f 7 ("In March 2010 [redacted] initiated an investigation of a worldwide criminal 
organization known as the 'Mega Conspiracy' . . . DEFENDANTS and others are members of 
the Mega Conspiracy.").) Thus, it now appears that the Government was seeking cooperation 
and information from Megaupload in June 2010 without informing Megaupload that it was an 
investigatory target. Notably, the Government avoided communicating with Megaupload 
directly, instead deputizing Carpathia to do so on its behalf. (See June 25, 2010 email from Phil 
Hedlund to Mathias Ortmann and Kim Dotcom, Ex. 1 ("Please know that we attempted to 
convince the Government to work directly with Mega on this matter, but given the complex 
jurisdictional issues, they have been unwilling.").) Far from warning Megaupload that the 
Government considered it to be part of a worldwide criminal organization, which the 
Government even at the time was terming the "Mega Conspiracy," the Government, through its 
anointed agent Carpathia, represented to Megaupload that "[w]e have no reason to believe the 
[sic] MegaUpload is the target of the investigation." (Id.) 
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Megaupload cooperated with the Government and voluntarily arranged with Carpathia to 
supply the Government with the files identified in the sealed warrant. In accordance with the 
Government' s express admonitions — as conveyed to Megaupload through the sealing order and 
Carpathia' s instructions — Megaupload avoided signaling that anything was afoot or otherwise 
compromising the investigation, preserving the files in their original condition without alerting 
users or the public that anything had changed. At no time did the Government or Carpathia 
indicate that Megaupload could or should remove the files identified in the warrant from its 
cloud storage platform without compromising the stated secrecy of the investigation, much less 
did they suggest that Megaupload was legally obliged to do so lest it be complicit in an ongoing 
criminal conspiracy. 

Indeed, the Government' s message to Megaupload was precisely to the contrary — 
Megaupload was to take no action that could disclose the existence of the investigation. And 
Megaupload dutifully complied, doing precisely what the Government requested of it, ie., 
collect and provide the evidence concerning the infringing files, without taking any additional 
steps that might compromise the investigation. The Government would subsequently use 
Megaupload' s cooperation with the Government' s instruction as the sole direct evidence of 
Megaupload' s purported criminal intent; the Government did so specifically in support of the 
search warrants it executed against Megaupload and the individual defendants in January 2012. 
The Government' s representation squared neither with the facts well known to it nor with its 
constitutional obligation to disclose exculpatory evidence in its possession. See, e.g., Brady v. 
Maryland, 373 U.S. 83 (1963). 

The January, 2012 Warrants: More than one year after it had successfully enlisted 
Megaupload's assistance in retrieving copies of allegedly infringing files from its cloud storage 
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service, the Government seized upon Megaupload's cooperation as a core basis for criminal 
punishment. The Government came before this Court on January 13, 2012, ex parte, 
representing that its June 24, 2010 warrant had vested Megaupload with criminal mens rea. (See, 
e.g., Affidavit in Support of Warrant 1 :12-sw-34, Dkt. 145-1 at 1 1 Ij 17.) In at least five different 
warrants, the Government represented that, "[o]n or about June 24, 2010, members of the Mega 
Conspiracy were informed, pursuant to a criminal search warrant from the U.S. District Court for 
the Eastern District of Virginia, that thirty-nine infringing copies of copyrighted motion pictures 
were present on their leased servers at Carpathia Hosting, a hosting company headquartered in 
the Eastern District of Virginia," and that "[a]s of November 18, 2011, thirty-six of the thirty- 
nine infringing copies of copyrighted motion pictures were still being stored on servers 
controlled by the Mega Conspiracy," after it was informed of the infringing content. (See Dkt. 
145-1 at 11, 38, 61, 84, 105-106.) This single paragraph supplied the only direct, corroborated 
evidence of knowledge purportedly supporting each of the five warrants. 

Nowhere did the Government teil this Court that its June 24, 2010 warrant had been 
calculated to enlist good-faith cooperation with a criminal investigation, while preserving the 
secrecy thereof. Nowhere did the Government teil this Court that the Government had sought 
Megaupload's voluntary assistance in executing the warrant. Nowhere did the Government teil 
this Court that Carpathia had assured Megaupload, in the interests of its requested cooperation, 
that there was no basis to believe that Megaupload was a target. Nowhere did the Government 
teil this Court that Megaupload had in fact cooperated precisely as requested. Most importantly 
and most troublingly, nowhere did the Government teil this Court that Megaupload had been 
informed by Carpathia, acting on behalf of the Government and heeding the Government' s 
insistence upon sealing, that the secrecy of the warrant and the Government' s investigation must 
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be preserved to avoid destruction of evidence and notification of the targeted users. Nor did the 
Government inform this Court that the sealing order it had obtained and furnished Carpathia to 
provide to Megaupload likewise required secrecy and expressly specified that p^www'ifijffi 




In sum, 



nowhere did the Government teil this Court that Megaupload had done exactly what the 
Government had asked it to do — execute a search warrant without alerting the ostensible targets 
to the existence of an investigation. The Government' s contention to this Court that 
Megaupload' s preservation of the status quo was evidence of criminal intent is false, and 
deliberately so. 

Rule 41 (g) and Warrant-Related Filings: On May 25, 2012, interested party Kyle 
Goodwin filed his Motion for Return of Property pursuant to Federal Rule of Criminal Procedure 
41(g), seeking the return of data stored using Megaupload's cloud storage service. (Dkt. 90.) 
The Government opposed that motion on June 8, 2012. (Dkt. 99.) Following briefing, oral 
argument, and efforts at negotiated resolution of the motion, the Court issued an Order on 
October 2, 2012, indicating that "it is unable to reach a conclusion as to this matter without an 
evidentiary hearing." (See Dkt. 126.) The Court instructed that the hearing "shall be limited to 
argument and evidence concerning the applicability of Federal Rule of Criminal Procedure 
41(g)" and ordered Mr. Goodwin and the Government to file briefs addressing the suggested 
format and breadth of this hearing. (See id.) 

On October 30, 2012, the undersigned filed a motion to enter a special and limited 
appearance on behalf of Defendant and interested party Megaupload Limited for the purpose of 
filing a brief weighing in as to the suggested format and breadth of a Rule 41(g) hearing, 
attaching a proposed brief. (Dkt. 133.) At that time, the warrant materials related to this case 
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had not been unsealed. On November 20, 2012, the Court granted the undersigned's motion to 
enter a special and limited appearance, whereupon Megaupload's brief regarding a Rule 41(g) 
hearing was deemed filed nunc pro tune as of October 30, 2012. (Dkt. 148.) 

Earlier, on October 22, 2012, Mr. Goodwin had filed a motion to unseal search warrant 
materials. (Dkt. 131.) As grounds for unsealing the search warrant materials, Mr. Goodwin 
alerted this Court to numerous deficiencies that have been identified in warrants that were 
executed in New Zealand at the behest of the U.S. government. {Id. at 3-5.) Mr. Goodwin 
argued that, "[a]s part of any hearing under Rule 41(g), Mr. Goodwin will need to investigate the 
government's actions surrounding the searches and seizures that occurred here." {Id. at 7.) The 
Court granted that motion in part on November 15, 2012, and redacted copies of Warrants 1:12- 
sw-34, l:12-sw-35, l:12-sw-36, l:12-sw-37 and l:12-sw-40 were then made public. (Dkt. 145, 
145-1 .) The instant submission proceeds in the light of those revelations. 

DISCUSSION 

It is clear from the unsealed warrants that the Government withheld critical information 
from its supporting affidavits. That withholding calls into grave question the legality of any and 
all seizures effected pursuant to those warrants and is directly relevant to the upcoming 41(g) 
hearing and to Mr. Goodwin' s pending motion for return of property. And the withholding is all 
the more worrisome considering the identified pattern of governmental misconduct plaguing the 
proceedings in New Zealand. At this point, it is only appropriate that questions be asked and 
answered about why the Government withheld information from this Court as it did and as to 
whether it could have otherwise claimed proof of Megaupload's criminal mens rea had it not 
planted Megaupload's alleged knowledge of infringing files under false auspices of enlisting 
cooperation in a secret investigation of which Megaupload supposedly was not the target, and 
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then misleading this Court about the true intent behind Megaupload's assistance in executing the 
Government' s June 24, 2010 search warrant. Of course, Megaupload's alleged mens rea was in 
turn crucial to establishing the requisite probable cause for the sweeping searches and seizures 
which captured the property of innocent users such as Mr. Goodwin. 

A warrant is defective — and the resulting search and seizure are unlawful — if the affiant 
was dishonest or reckless in preparing his affidavit in support of the warrant, and if the allegedly 
false statement is necessary to the finding of probable cause, regardless whether a searching 
officer proceeded in good faith. United States, v. Leon, 468 U.S. 897, 926 (1984); Franks v. 
Delaware, 438 U.S. 154, 156 (1978). A court may order return of property pursuant to Rule 
41(g) on the basis that the warrants authorizing seizure of property were invalid. See United 
States v. Comprehensive Drug Testing, Inc., 513 F.3d 1085, 1105 (9th Cir. 2008) 
("Comprehensive Drug Testing I"), opinion revised and superseded in part by 621 F.3d 1162 
(9th Cir. 2010) ("Comprehensive Drug Testing II"). 

Mr. Goodwin has sought to challenge the validity of the warrants used to seize his 
property, and the lawfulness of the government's ensuing actions, even before the warrants and 
the materials offered in support of them were unsealed. (Dkt. 91, at 6; Dkt. 131 at 7.) Now that 
they have been unsealed, Mr. Goodwin' s concerns about their infirmity have only been 
confirmed and vindicated. Mr. Goodwin deserves further opportunity to explore the warrants 
and their validity at a Rule 41(g) hearing, including evidence that the Government misled this 
Court on the key matter of Megaupload's purported criminal intent. Because Megaupload is in 
the best position to analyze the evidence illuminating these marters, it respectfully submits that it 
should be afforded an opportunity to specially participate and make argument through specially 
appearing counsel Quinn Emanuel and the Rothken Law Firm at a Rule 41(g) hearing. 
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CONCLUSION 

For the foregoing reasons, specially appearing Defendant Megaupload respectfülly 
requests that the Court allow the participants in any Rule 41(g) hearing, including Megaupload, 
the opportunity to address the validity of Warrant l:12-sw-34, l:12-sw-35, l:12-sw-36, l:12-sw- 
37, and l:12-sw-40, of any accompanying materials offered in support thereof, and of any other 
relevant materials that might be unsealed in the meantime. 

Respectfülly submitted, 



Ira P. Rothken 
ROTHKEN LAW FIRM 
3 Hamilton Landing 
Suite 280 

Novato, CA 94949 
(415) 924-4250 
(415) 924-2905 (fax) 
ira@techfirm.net 



/s/ Heather H. Martin 

William A. Burck 
Derek L. Shaffer 

Heather H. Martin (VSB # 65694) 
QUINN EMANUEL URQUHART & 
SULLIVAN LLP 

1299 Pennsylvania Avenue N.W., Suite 825 

Washington, D.C. 20004 

(202) 538-8000 

(202) 538-8100 (fax) 

williamburck@quinnemanuel.com 

derekshaffer@q uinnemanuel . com 

heathermartin@quinnemanuel.com 



Carey R. Ramos 

Robert L. Raskopf 

Andrew H. Schapiro 

QUINN EMANUEL URQUHARL & 

SULLIVAN LLP 

51 Madison Avenue, 22 nd Floor 

New York, N.Y. 10010 

(212) 849-7000 

(212) 849-7100 

care yramo s@quinnemanuel . com 
robertraskopf@quinnemanuel.com 
andre wschapiro @quinnemanuel . com 

Counsel for Defendant Megaupload Limited 
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CERTIFICATE OF SERVICE 

I hereby certify that on January 2, 2013, the foregoing [PROPOSED] REDACTED 
SUPPLEMENTAL BRIEF OF SPECIALLY APPEARING DEFENDANT AND 
INTERESTED PARTY MEGAUPLOAD LIMITED REGARDING RULE 41 (G) 
HEARING was filed and served electronically by the Court's CM/ECF system upon all 
registered users. 



/s/ Heather H. Martin 

Heather H. Martin (VSB # 65694) 
QUINN EMANUEL URQUHART & 
SULLIVAN LLP 

1299 Pennsylvania Avenue N.W., Suite 825 
Washington, D.C. 20004 
(202) 538-8000 
(202) 538-8100 (fax) 
heathermartin@quinnemanuel.com 
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EXHIBIT 1 
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From: Phil Hedlund < phedlimd@carpathiahost.com > 
Date: Fri, Jun 25, 2010 at 12:06 PM 
Subject: Search Warrant - Urgent 

To: Mathias Ortmann <mo@uae.de >,, Mathias Ortmann < mo@megaupload.com >, Kim 
<hq@megaupload.com > 

Cc: Peter Weber < pweber@carpathiahost.com >, Sean Walsh <swalsh@carpathiahost.com > 
Kim and Mathias, 

Please fmd attached a Search Warrant received by Carpathia today. Over the past days (since 
our return from our visit to you); Carpathia has been negotiating with the Government to avoid 
receiving a search warrant that could result in a seizure or imaging of the servers Carpathia 
provides to Mega. Instead, we've managed to convince the Government to issue this sealed 
(meaning we cannot disclose to anybody) warrant with an exception to disclose to you. Please 
know that we attempted to convince the Government to work directly with Mega on this matter, 
but given the complex jurisdictional issues, they have been unwilling. Nonetheless, Carpathia 
feels as if we've achieved a small victory by preventing the Government from issuing a search 
warrant giving them power to seize or image the servers themselves. Kim, we were able to do 
this specifically because we relayed to the Government Mega's willingness to work with the 
Government for these types of requests - just as we discussed during the last day of our visit 
(boy, am I happy we discussed it). 

Carpathia needs your help collecting the information sought in this warrant so Carpathia can 
hand the information over to the Government. We have no reason to believe the MegaUpload is 
the target of the investigation. Mega's assistance in providing this information is the path most 
likely to avoid any disruption of services. 

We specifically need (please note: I'm summarizing the Search Warrant; please read and rely on 
the actual Search Warrant, not my summary in case I made a typo): 
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Given that the Government wants actual copies of the files themselves, I suspect that the easiest 
mechanism to consolidate this information would be to identify a specific 1 .5Tb disk (or disks) 
on one of the Supermicro servers in Ashburn and move all the files to that disk (or disks). Once 
that is done, Carpathia can then remove those disks and give them to the Government. Of 
course, Carpathia will replace the removed disks with spares immediately. Because of the 
Government' s seal on the warrant, please do not open EM7 tickets, but instead deal directly with 
Sean Walsh ( swalsh@carpathiahost.com ) to coordinate any assistance you need from Carpathia 
operations. 

If you would please confirm as soon as possible that Mega will assist in collecting and providing 
this information, Carpathia will communicate that to the Government. Also, please let us know 
how long you think you may need to collect this data so we can set expectations with the 
Government, that would be helpful too. 

Please do not hesitate to call me with any questions. 



Philip Hedlund 

Sr. Director Business Development 
Carpathia Hosting, Ine 
43480 Yukon Drive 
Suite 200 

Ashburn, VA 20147 

(303) 523 9702 cell 
(703) 738 7073 fax 
www.carpathiahosting.com 

This message is for the designated recipiënt only and may contain privileged, proprietary, or 
otherwise confidential information. If you have received it in error, please notify the sender 
immediately and delete the original. Any other use of the email by you is prohibited. 
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EXHIBIT 2 
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FILED UNDER SEAL 



